Re: [AVT] SSRC to DTLS-SRTP mapping

[Eric Rescorla <ekr at networkresonance.com>]

At Thu, 21 Feb 2008 15:44:40 +0000,
Colin Perkins wrote:
> 
> On 19 Feb 2008, at 23:03, Dan Wing wrote:
> >> On 19 Feb 2008, at 17:21, Dan Wing wrote:
> >> ...
> >>> However, I am worried about an attack flooding a device and causing
> >>> the device to perform SHA1 operations, when it seems we could
> >>> communicate the SSRC in the DTLS exchange (handshake or separate
> >>> message), and/or use source address verification to help protect
> >>> devices from such an attack.
> >>>
> >>> If it's only me that has this concern, I will sit back down in my
> >>> chair.
> >>
> >> I see the concern, but I think this has to work in the general case,
> >> without signalling support (except the DTLS handshake). I have no
> >> problem with there being optimisations possible in those cases where
> >> the SSRC to host/port pair mapping can be signalled out of band
> >> though, since there will certainly be scenarios where that's  
> >> possible.
> >
> > Would dropping a DTLS packet on the floor if its source IP address and
> > port are different from the DTLS handshake be acceptable?
> 
> 
> Yes, I think so. Why do you think it might not be?

Dan, do you really mean "DTLS packet" or do you mean "SRTP Packet"?

Because I think the answer is different for DTLS is "yes" but
SRTP is "no"--again, unless I've badly misunderstood RTP,
which is totally possible.

-Ekr
_______________________________________________
Audio/Video Transport Working Group
avt at ietf.org
http://www.ietf.org/mailman/listinfo/avt